CyberPro

Transcription

CyberPro

CyberPro
Volume 2, Edition 21
October 22, 2009
Keeping Cyberspace Professionals Informed
Officers
President
Larry K. McKee, Jr.
Chief Operations Officer
Jim Ed Crouch
-----------------------------CyberPro Editor-in-Chief
Lindsay Trimble
CyberPro Research Analyst
Kathryn Stephens
The articles and information appearing herein are intended for
educational purposes to promote discussion in the public interest and to
keep subscribers who are involved in the development of Cyber-related
concepts and initiatives informed on items of common interest. The
newsletter and the information contained therein are not intended to
provide a competitive advantage for any commercial firm. Any misuse or
unauthorized use of the newsletter and its contents will result in removal
from the distribution list and/or possible administrative, civil, and/or
criminal action.
The views, opinions, and/or findings and recommendations contained in
this summary are those of the authors and should not be construed as an
official position, policy, or decision of the United States Government, U.S.
Department of Defense, or National Security Cyberspace Institute.
CyberPro Archive
To subscribe or unsubscribe to this newsletter click here CyberPro News Subscription.
Please contact Lindsay Trimble regarding CyberPro subscription, sponsorship, and/or advertisement.
All rights reserved. CyberPro may not be published, broadcast,
rewritten or redistributed without prior NSCI consent.
110 Royal Aberdeen 
CyberPro
Smithfield, VA 23430 
National Security Cyberspace Institute
ph. (757) 871-3578
Page |1
CyberPro
October 22, 2009
TABLE OF CONTENTS
This Week in CyberPro ........................................................................................................... 5
Cyber Jihad – Use of the virtual world .................................................................................... 6
Panel: How business can beat hackers at their own game .................................................... 11
Education & Training ........................................................................................................... 12
Cyberspace – Big Picture ...................................................................................................... 13
Some Key Events in the History of Cyber Warfare................................................................................. 13
Top Tech Firms Back Net-Neutrality Rules ............................................................................................ 13
Cyber Consortium Gets $2.7 Million Grant ............................................................................................. 13
SC World Congress: Feds Talk Cybersecurity ....................................................................................... 13
Cyberspace – U.S. Government ............................................................................................ 14
House Panel Plans Cybersecurity Training Sessions for Members and Staff ....................................... 14
White House Blogs Cybersecurity .......................................................................................................... 15
White House Warns Public on Cyber Threat .......................................................................................... 15
Hathaway Joins Kennedy School as Senior Adviser .............................................................................. 15
Cyber Security: California to Join U.S. Cyber Challenge ....................................................................... 15
Recruiting 11,000 IT Workers ................................................................................................................. 16
CIA Building Secure Cloud-Based System ............................................................................................. 16
NASA Systems and Data Vulnerable to Hackers, Malicious Employees ............................................... 16
Cyberwar Readiness Recast as Low Priority ......................................................................................... 17
FBI Takes to Planes in Global Fight Against Cybercrime ...................................................................... 17
U.S. Cyber Leadership Debate .............................................................................................. 18
Hacker Jeff Moss: Inter-Agency Turf War Plague Cybersecurity Effort ................................................. 18
Cyberspace – Department of Defense (DoD) ........................................................................ 19
U.S. Cyber Command Now Fully Online, and Seeking a Few Good Geeks .......................................... 19
DARPA, Microsoft, Lockheed Team Up to Reinvent TCP/IP ................................................................. 19
Pentagon Officials Stress Cybersecurity ................................................................................................ 19
Pentagon Backs Off Cloud Availability Claims ....................................................................................... 19
How DoD’s Bob Lentz Changed the Role of Chief Information Security Officer .................................... 20
U.S. Navy Creates Command to Maintain Cyber Supremacy ................................................................ 20
The Information Dominance Corps ......................................................................................................... 20
Fort Meade to be Cyber Defense Home ................................................................................................. 20
CyberPro
ph. (757) 871-3578
Page |2
CyberPro
October 22, 2009
Yep, Computers for Offensive Ops ......................................................................................................... 21
Air Force Activates New Cyberspace Defense Unit ............................................................................... 21
Keesler AFB Begins Cyber Warfare Training ......................................................................................... 21
Cyberspace – Department of Homeland Security (DHS) ........................................................ 22
DHS Web Sites Vulnerable to Hackers, IG Says ................................................................................... 22
Cyberspace – International .................................................................................................. 22
Cyberwar: Sooner or Later, or Now ........................................................................................................ 22
IMPACT Boss Warns of Long Struggle with Cyber Crime ..................................................................... 22
National Cybersecurity Agencies Most Effective Against Cyber Attacks: IMPACT Chairman ............... 23
U.N. Warns the Next World War will be Online ...................................................................................... 23
U.S. Gen. Urges More Effort Against Cyber Attacks .............................................................................. 23
State to Award Social Networking Grants in Middle East, Africa ........................................................... 23
EU Signs Up New Cyber-Security Boss ................................................................................................. 24
Polish Government Cyberattack Blamed on Russia............................................................................... 24
‘Hack Idol’ To Find Top UK Cyberwarriors ............................................................................................. 24
S. Korea’s Classified Information Withdrawn via Hacking: Official ......................................................... 24
Report: NKorea Hackers Steal SKorea Toxic Secrets ........................................................................... 25
Cyberspace Research ........................................................................................................... 25
Gartner: Loosen Up on Social Networks, Security ................................................................................. 25
Classic Cyber Crimes Could Pose Future Threats ................................................................................. 26
Cybersecurity Provider Says Most Agencies Have Already Been Attacked .......................................... 26
U.S. Must Focus on Protecting Critical Computer Networks from Cyber Attack, Experts Urge ............. 26
Cyber Terrorism Demands New Tactics: Study ..................................................................................... 26
Study: U.S. Should Focus on Protecting Critical Computer Networks ................................................... 27
SSL Still Mostly Misunderstood .............................................................................................................. 27
Enterprises Confident in Defenses Against External Attacks, Study Says ............................................ 27
Cyberspace Hacks and Attacks ............................................................................................. 28
How Hackers Find Your Weak Spots ..................................................................................................... 28
Fake Security Software in Millions of Computers: Symantec ................................................................. 28
Gumblar Botnet Awakens After Five Months to Distribute Malware ....................................................... 28
With Botnets Everywhere, DDoS Attacks Get Cheaper ......................................................................... 28
Phishing Attacks with Zeus Trojan Targeting Outlook Webmail Shops ................................................. 29
Malware Posing as Postal Tracking E-Mail ............................................................................................ 29
CyberPro
ph. (757) 871-3578
Page |3
CyberPro
October 22, 2009
Is Phishing on the Decline, Or Just Moving to a New Phishing Hole? ................................................... 30
Hackers Plunder Bank Accounts at Unsuspecting Small Businesses and School Districts................... 30
Bahama Botnet Said to Steal Traffic From Google ................................................................................ 30
Zeus Trojan Infiltrates Bank Security Firm ............................................................................................. 30
Users Hit by New Wave of SQL Attacks ................................................................................................. 31
Cyberspace Tactics and Defense .......................................................................................... 31
Comcast Takes Revolutionary Security Step ......................................................................................... 31
Adobe Warns of Critical Threat to Reader, Acrobat Users ..................................................................... 31
Anti-Wi-Fi Paint Offers Security .............................................................................................................. 32
Cyberspace - Legal ............................................................................................................... 32
Commerce Aide: Cybersecurity Bill Moving ........................................................................................... 32
Fed Regulation of Private Data Mulled ................................................................................................... 33
Fugitive Hacker Headed Back to U.S. for Arraignment .......................................................................... 33
Delta Air Lines Sued over Alleged E-Mail Hacking................................................................................. 33
NASA Hacker Makes Extra-Judicial Appeal ........................................................................................... 33
Operation Phish Phry Hooks 100 in U.S. and Egypt .............................................................................. 34
Cyberspace-Related Conferences ......................................................................................... 35
Cyberspace-Related Training Courses .................................................................................. 36
Cyber Business Development Opportunities ........................................................................ 38
Employment Opportunities with NSCI.................................................................................. 41
CyberPro Content/Distribution ............................................................................................ 41
CyberPro
ph. (757) 871-3578
Page |4
CyberPro
October 22, 2009
THIS WEEK IN CYBERPRO
BY LINDSAY TRIMBLE, NATIONAL SECURITY CYBERSPACE INSTITUTE, INC.
As part of National Cybersecurity Awareness Month, congressional staff will get “cyber flu shots” (page
14). There will be two informative events next week – one will focus on protecting personal computers
and handheld devices from hacks and the other will present information on social networking site
protection. The Obama administration also used this month to add three new blogs to the White House
Web site (page 15). The blogs discussed computer users’ roles in network security; common computer
threats; and an introduction to onguardonline.gov, a site that will provide tips for users to protect
themselves online.
While NASA prepares to launch space shuttle Atlantis next month, the agency is also making headlines
regarding network security. British hacker Gary McKinnon is facing extradition to the United States for
hacking into 97 U.S. government computers, including NASA (page 33). A recent report from the
Government Accountability Office states that NASA centers are not doing enough to restrict access and
apply security patches on outside applications (page 16). In fiscal 2007-2008, NASA reported 839
malicious code attacks – the highest of any federal agency. The GAO has recommended that NASA
tighten security controls and develop a comprehensive information security program.
Cyber warfare was discussed at the International Telecommunications Union’s Telecom World 2009 in
Geneva (page 22). ITU Secretary General Hamadoun Toure commented that in cyberwar, there are no
superpowers, so the Internet provides a level playing field for nations. U.S. Army Lt. Col. Gregory Conti
promoted the idea of a separate cyber military branch to conduct defensive and offensive operations.
Last week, Federal Computer Week published an article on key events in cyber warfare’s history – the
first hacker forum, memorable hacker attacks and key events in cyber policy (page 13). Experts will
discuss cyber warfare’s parallels to ancient war tactics in the Sun Tzu and the Art of Information Security
panel discussion Nov. 4 in Dallas, Texas (page 11).
Our feature article this week is by Jeff Bardin, Treadstone 71, an expert in information assurance and
cyber intelligence with a Middle East focus, and takes a look at one aspect of cyber warfare (page 6). In
this article, Bardin discusses how jihadists use the Internet to recruit, instruct and promote martyrdom.
He examines these online communities, gives an example of a successful attack and explains how
Extremist Islamists proficiently use Western technology against us.
We hope you enjoy this edition of CyberPro!
CyberPro
ph. (757) 871-3578
Page |5
CyberPro
October 22, 2009
CYBER JIHAD – USE OF THE VIRTUAL WORLD
BY JEFF BARDIN, TREADSTONE 71
“You have no need for new legislation; simply put into effect that which has already been
legislated for you. This will save you a good deal of time and effort … Everything, praise
be to God is ready-made for use.” – Ayatollah Ruholla Khomeini (Kramer, 1980)
Introduction
Usama Bin Laden once indicated that 90 percent of the war against the non-believers is in information.
Prior to, and more importantly since that edict, there has been an explosion of information flowing
across the virtual airwaves as jihadists flock to the Internet to spread their messages of martyrdom,
recruitment, instruction and education, awareness and community building without borders. This brief
touches upon their use of social networking communities, cloud computing, how their messaging goes
viral, the changing face of Extremist Islamists and their continued use of our infrastructure against us.
Jihadist online communities
Jihadist online communities have operated for years, usually under the guise of legitimately-acquired
software that provides ease of setup and use. The main software in use is vBulletin. This software runs
between $195
and $235 per
license and
supports
unlimited users
providing online
forums, e-mail
and many other
features.
Figure 1 Standard Video Introduction
Many news agencies call the jihadist sites Al-Qa’eda sites, but in fact almost all of them are Extremist
Islamist (EI) sites that may have Al-Qa’eda participants. It used to be rather difficult to enroll in these
sites, but the restrictions have eased over the years and have led to English and German language sites
in their efforts to expand their reach. Many aspiring jihadis and martyrs get their indoctrination and
“book learning” on these sites, becoming inspired by the feats of the shaheed captured in images and
video while anything Western is reviled. One of the standard video introductions – making martyrdom
appear as a peaceful and positive experience – is depicted above in Figure 1.
CyberPro
ph. (757) 871-3578
Page |6
CyberPro
October 22, 2009
What are the types of Jihad?
Over the last few decades, jihadis have perfected a series of effective Jihads against the non-Muslim
world. There are many Jihads the Extremist Islamists (EI) use and they all support their ultimate goal of
an Islamic world ruled by Shari a law. Some of them are:
Criminal Jihad ‫جهاد الجنائيت‬
Cultural Jihad ‫جهاد الثقافيت‬
Demographic Jihad ‫السكاى جهاد‬
Economic Jihad ‫جهاد االقتصادي‬
Education Jihad ‫التعلين جهاد‬
Financial Jihad ‫جهاد الواليت‬
Immigration Jihad ‫جهاد والهجرة‬
Institutional Jihad ‫هؤسسيت الجهاد‬
Intellectual Jihad ‫جهاد الفكري‬
Media Jihad ‫وسائل اإلعالم جهاد‬
Military Jihad ‫جهاد العسكري‬
Political Jihad ‫جهاد السياسي‬
Religious Jihad ‫جهاد الديني‬
Thuggery Jihad ‫البلطجت جهاد‬
There are also other types of jihad that relate to the self that may in fact apply to EIs, but are general to
Islam as a whole. What is universal with all these types of jihad is that they exist in one form or another
via various Internet protocols creating the basis for Cyber Jihad. It is important to understand that the
EIs continue to use our infrastructure against us as they have over the years during physical attacks and
currently using social network software and sites to drive awareness and training, while building
recruitment through online communities and various forms of propaganda.
What happened in Madrid?
March 11, 2004, 7:39 a.m.: the first of 10 bombs explode on four trains carrying commuters from
Madrid to the city center. The blasts rip huge holes in the trains. Ambulances race to the scene and local
hospitals are quickly flooded with victims. Passengers and passersby help rescue the injured, while
hundreds respond to an urgent appeal
for blood donors. Nearly 200 people
were killed and approximately 1,400
were injured in the Madrid terror
attacks. Eventually, the election in
Spain would result in a complete
regime change as voters removed the
right-leaning prime minister and his
policies as aligned to George W. Bush.
Figure 2 Madrid Bombing 2004
The Madrid bombing is an interesting case in the execution, planning and overall skill displayed by the
assailants. The assailants were not tied to Al-Qaeda but they did align themselves philosophically with
Bin Laden’s beliefs. This group of terrorists acquired Mitsubishi Trium T110 Mobile phones as their tools
for triggering the explosives and learned how to perform such tasks by downloading instructional
manuals from EI vBulletin sites. They also acquired hashish and used it to trade for explosives from a
former miner.
CyberPro
ph. (757) 871-3578
Page |7
CyberPro
October 22, 2009
Another interesting twist is their acquisition of law enforcement
evidence photos they marked with their logo and bundled with the CBS
News report that included the security camera footage of the blasts
(Figures 2 and 3). The sequencing of the blasts as they funneled the
victims towards the upper platforms was perfectly timed. It could be
argued that they hacked the security camera system to trigger the
phone detonators as crowds huddled closely together.
Figure 3 Madrid Bombing
The group largely self-funded their operation through the sale of drugs.
After the bombing, 125,800 tablets of ecstasy were found and Spanish authorities eventually recovered
$2 million in other drugs and cash.
Cloud Storage Sites
In conjunction with their use of social networking sites, EIs use many different cloud storage sites at
once to upload their propaganda. Links from various EI sites, mostly running vBulletin, lead the jihadi to
Word documents, Adobe Acrobat documents and videos of various types (Real Media, Windows Media,
etc.) and quality are posted on sites such as rapidshare, 2share, megauploads and others. These are
legitimate sites that charge a fee for service to upload documents of up to two gigabytes. The uploads
usually include video compressed specifically for mobile devices. These videos go viral sometimes within
minutes after posting, making their way to Facebook, YouTube and other social networking sites.
News Spokesmen
The Islamic Emirate of Afghanistan under the Taliban release news flashes as they occur from
Afghanistan and the tribal areas along the border with Pakistan. The two best known spokesmen for the
Taliban list their satellite and cell numbers based upon their areas of coverage (Figure 4). These numbers
have been in operation for more than a year and are still active. The news flashes are shaded with their
view of what actually happens and include a dose of exaggeration. What is unique about these news
flashes is the speed
with which they reach
the Internet and then,
go viral. Their ability to
get the message out –
first via the vBulletinbased communities –
ensures their
viewpoint is heard first
and, sometimes, it’s
Figure 4 Taliban Spokesman Contact Information
the only viewpoint
heard at all.
CyberPro
ph. (757) 871-3578
Page |8
CyberPro
October 22, 2009
Expansion of their message
Over the past several months, EIs have focused on releasing more videos and MP3s packaged as video
that are either in Arabic with English subtitles or in English as spoken by former U.S. citizens (as well as
their expansion of “other than Arabic language” media). The point is to demonstrate that their
movement is global and any believer can join the cause regardless of race, creed or color.
Omar Hammami of Daphne, Ala. – better known as Abu Mansoor Al-Amriki – represents the Mujahideen
Students or Shabaab in Somalia. Reported to be a former special forces soldier who saw action in
Bosnia, Omar voices Al-Qa’eda rhetoric in American English with his own brand of mispronunciations
and grammatical errors.
Adam Yehiye Gadahn – aka Azzam the American – has his roots in Southern California. Al-Qa’eda has
resorted to using an American-born, former Jew, former Christian, converted Muslim (at age 17) to
communicate their messages of Jihad (www.fbi.gov/wanted/terrorists/gadahn_a.htm). Gadahn, a
“reformed” heavy metal rocker, has perfected his Arabic over the years and is rumored to be the
technical expert behind As-Sahab Media (The Cloud Media) and the translator for many previous videos
and MP3s from Zawahiri and Bin Laden.
Who owns it?
The ease of use of the vBulletin-based communities makes
it a natural choice for jihadi communities. The software
holds together well and provides an array of functions that
make it the tool of choice for jihadi awareness, training
and communication. Their use of this tool far outweighs
the Web 2.0 usage within corporate America. In fact, their
use of Web 2.0 technology is the stuff dreams are made of
for corporate CISOs who wish their awareness messages
could follow such a viral path. If security awareness and
training would elicit the same level of participation and
interest, we would have very few security issues in our
corporate IT environments.
I decided I had to find out who owns vBulletin. vBulletin
started as Jelsoft in 1999, located 90 kilometers west of
London. Jelsoft was purchased by a U.S. company in June
2007 that went IPO in July of the same year. Internet
Figure 3 Institutional Investors
Brands located in El Segundo, Calif., may be best known for
such online sites as bargainist.com, wikitravel.com, carsdirect.com and autos.com. Each of these sites
have won some sort of Web award over the years. It is my estimation that vBulletin would be voted the
Best Jihadi Social Networking Tool by As-Sahab Media if given the chance.
CyberPro
ph. (757) 871-3578
Page |9
CyberPro
October 22, 2009
With little effort, it is easy to find out who really owns vBulletin. The Internet Brands Web site lists the
corporate officers and board members – some of whom are well known throughout America. What is
most interesting is that the true ownership lies with each and every one of us who invests in mutual
funds and stocks. Come to find out, I own some of vBulletin through various funds such as TIAA-CREF
and other institutional investors (Figure 5). As a true example of their ability to take our infrastructure
and use it against us, the EIs demonstrate again that what we can develop, they can use and use to its
fullest potential, whether for good or nefarious purposes. It is apropos that we would have investments
in this tool.
Summary
The EIs use of the Internet and various technologies as methods to rapidly communicate their
propaganda is a modern model for information dissemination and community expansion. Social
networking sites and Web 2.0 technologies provide the platforms for training, awareness and education
that goes viral as quickly as data can be uploaded. The past several months demonstrate their ability to
continually mature their methods while attempting to demonstrate that their appeal is worldwide.
Since the days of Irhabi0071, the EIs have flocked to vBulletin. Its use has become second nature to
members due to its monopolistic lock for online community building. Its use is also representative of the
continued facilitation by Western infrastructure as the tool of choice to spread their perverted religious
views.
About the Author
Jeff Bardin, Treadstone 71, has held Top Secret clearances while breaking codes and ciphers and
performing Arabic language translations serving in the U.S. Air Force and at the National Security
Agency. He also served as an Armored Scout Platoon Leader and Army officer. He has worked in
leadership positions for Fortune 100 organizations. Bardin also has international experience in the
greater Mediterranean region and the Kingdom of Saudi Arabia. He received the 2007 RSA Conference
award for Excellence in the Field of Security Practices. The Bardin-led security team also won the 2007 SC
Magazine Award for Best Security Team. Bardin has served as the CSO/CISO for Fortune 1000 firms and
is the principal for Treadstone 71, specializing in information assurance and cyber intelligence with a
Middle East focus. Bardin holds holds CISSP, CISM, CHS and NSA IAM certifications.
1
Younis Tsouli, (aka Irhabi007 – Terrorist 007) a 22-year-old arrested in Westminster, outside of London, in 2005 for using
cyberspace to share intelligence information, create online communities and post videos and other information.
CyberPro
ph. (757) 871-3578
P a g e | 10
CyberPro
October 22, 2009
PANEL: HOW BUSINESS CAN BEAT HACKERS AT THEIR OWN GAME
The SecureWorld Expo will host the Sun Tzu and the Art of Information Security panel from 3 to 4 p.m.
Nov. 4 at the Plano Convention Centre in Dallas, Texas.
Sun Tzu's The Art of War is considered a fundamental text on strategic thinking and has been applied to
military, political and business challenges. A panel of security experts will discuss the applicability of Sun
Tzu's insights to fusing information security and business strategy. Discussion topics will include how
hackers use these strategies and how companies can use the same strategies to defend themselves.
“Attack and defense is predicated on understanding not only both combatants’ strengths and
vulnerabilities, but also the terrain on which a battle is fought,” said Steven F. Fox, sponsorship director
for the Motor City ISSA Chapter and moderator for the Nov. 4 panel discussion. “Sun Tzu’s relevance lies
in orchestrating a strategy that takes these factors into account. The ability to defend our assets relies
on understanding our strengths and weaknesses from the opponent’s perspective. We must understand
the conflicts that compel our opponents, be they individual, corporate or international. According to Sun
Tzu, security professionals must go beyond an assessment of risk to identify what security means to the
organization. This information allows the security team to defeat the tactics of the opponent and upset
their strategies.”
Panelists include Joseph J. McKernan, director of Security Engineering for Verizon Business; Kent Nabors,
vice president of Information Security for a financial institution; and Dennis Thibodeaux, director of
Digital Forensics for the American College of Forensic Examiners Institute.
“We must nurture behaviors which reflect an assessment of risk that is consistent with all aspects of our
lives, not just the hours we spend at work,” said Fox. “The Art of War serves as a framework for acting
on this information strategically.”
For more information, contact Steven F. Fox at [email protected].
CyberPro
ph. (757) 871-3578
P a g e | 11
CyberPro
October 22, 2009
EDUCATION & TRAINING
Need help tracking and managing your
workforce training programs?
Global Knowledge’s GlobalForce Information Assurance (IA) Workforce
Management Tool gives you the ability to effectively track, manage and
report on all of your compliancy training program activities.
GlobalForce fulfills the policies set forth by Defense Information Systems
Agency, DoD Directive 8570.1, Office of Management and Budget
Circular 130-Appendix III, PDD 63, E-Gov Act, Presidents Management
Agenda, and is consistent with many agency IT training programs.
Visit www.globalknowledge.com/GlobalForce to learn more.
CyberPro
ph. (757) 871-3578
P a g e | 12
CyberPro
October 22, 2009
CYBERSPACE – BIG PICTURE
Some Key Events in the History of Cyber
Warfare
BY: AMBER CORRIN, FEDERAL COMPUTER WEEK
10/15/2009
This article is a list of some key dates in the
history of cyber warfare, beginning with the
first hacker forum – a crude electronic
messaging board created in 1979. The list also
includes memorable hacks, such as the attacks
on NATO systems in March 1999 by hackers in
Serbia responding to NATO’s military
intervention in Kosovo, and a wave of
cyberattacks from China against U.S.
government Web sites in May 1999. The article
also mentions the attacks from the Russian
government on the Web sites of Estonia’s
parliament, banks, ministries and newspapers in
April and May 2007. The article includes events
as recent as this month, when the new U.S.
Cyber Command is scheduled to begin
overseeing the protection of military networks
from online threats.
http://fcw.com/articles/2009/10/19/feat-dodcyber-timeline.aspx
Top Tech Firms Back Net-Neutrality Rules
BY: CECELIA KANG, THE WASHINGTON POST
10/20/2009
Silicon Valley titans and early technologists of
the Web are supporting the Federal
Communications Commission’s efforts to
develop net-neutrality rules which keep
Internet Service Providers from favoring certain
applications over others. An FCC official says
that the rule-making proposal will include
questions that will bring comments from the
public and companies. Twenty-four executives
of Internet content and telecom service
companies, including Google, Twitter and
CyberPro
Facebook, recently drafted a letter that said
America’s leadership in technology has been
due to the open nature of the Internet, and
applauded the FCC for creating rules to protect
the open qualities of the Internet.
http://www.washingtonpost.com/wpdyn/content/article/2009/10/19/AR200910190
3575.html
Cyber Consortium Gets $2.7 Million Grant
BY: TIM TALLEY, ENTERPRISE SECURITY TODAY
10/16/2009
The National Science Foundation recently
awarded a $2.7 million grant to the Cyber
Security Education Consortium to help train the
“new generation of cyber warriors.” Richard M.
George, technical director for information
assurance for the National Security Agency at
Fort Meade, says that education is critical for
combating threats in cyberspace. The
consortium was established in 2002 to develop
cyber security programs at technology centers
and two-year colleges in Oklahoma, and has
since expanded into seven other states and
includes 32 institutions and more than 1,250
students. Programs funded by the grant will
include cyber security education and work force
development training.
http://www.enterprise-securitytoday.com/story.xhtml?story_id=69519
SC World Congress: Feds Talk
Cybersecurity
BY: ANGELA MOSCARITOLO, SC MAGAZINE
10/14/2009
Top officials from U.S. law enforcement and
government agencies speaking at SC World
Congress in New York this week said progress
has been made in fighting cybercrime recently
ph. (757) 871-3578
P a g e | 13
CyberPro
October 22, 2009
and efforts to cooperate with foreign law
enforcement agencies have paid off in the fight
against cybercriminals. Agents are working
hand-in-hand with international law
enforcement agents to build cases against
cybercriminals and make
arrests, but acknowledge that while the ability
for federal law enforcement bodies to fight
cybercrime is evolving, so are the threats. In
addition to the importance of international
collaboration, relationships with private-sector
information security professionals are also
critical to successfully fighting cybercrime.
http://www.scmagazineus.com/SC-WorldCongress-Feds-talkcybersecurity/article/152294/
CYBERSPACE – U.S. GOVERNMENT
House Panel Plans Cybersecurity Training
Sessions for Members and Staff
BY: JILL R. AITORO, NEXTGOV.COM
10/13/2009
As part of National Cybersecurity Awareness
Month, the House Subcommittee on Emerging
Threats, Cybersecurity, Science and Technology
has decided to provide “cyber flu shots” in the
form of practices that House members and
CyberPro
congressional staff can use to defend their
computers, networks and information from
viruses. The first event, Oct. 27, will include
information on protecting computers and
handheld devices from being infected with
malicious software. The second event, Oct. 30,
will focus on protecting information on social
networking sites. The subcommittee has also
announced that it will hold a closed briefing
ph. (757) 871-3578
P a g e | 14
CyberPro
October 22, 2009
with industry to discuss cybersecurity policies.
The subcommittee is encouraging the
appointment of a cyber coordinator to bring
accountability and urgency to setting policies
and legislation.
http://www.nextgov.com/nextgov/ng_2009101
3_9888.php
unprecedented denial-of-service attacks against
banking, government, or other important Web
sites.”
http://blogs.govinfosecurity.com/posts.php?po
stID=324
White House Blogs Cybersecurity
BY: ERIC CHABROW, GOVERNMENT INFORMATION
SECURITY
10/07/2009
BY: JILL R. AITORO, NEXTGOV.COM
10/16/2009
The Obama administration has added three
blogs to WhiteHouse.gov since the beginning of
October, National Cybersecurity Awareness
Month. In his first post, John Brennan discussed
the importance of the government and
individual computer users’ roles in security
networks and information. In his second post,
Brenner talked about common threats including
spam, worms, botnets and Trojans. The third
post included a video message from President
Barack Obama and a link to onguardonline.gov,
the joint effort of 12 federal agencies and 18
nongovernment organizations that hopes to
provide tips to help computer users protect
themselves online.
http://techinsider.nextgov.com/2009/10/white
_house_blogs_cybersecurity.php
White House Warns Public on Cyber Threat
SECURITY
10/13/2009
In the White House blog, John Brennan,
assistant to the president for homeland security
and counterterrorism, says that 25 percent of
all personal computers are a part of some
botnet. Brennan briefly discusses the Conficker
virus, which has infected millions of machines
through network connections and portable
media. Brennan also says that the botnets are
used primarily for criminal activity such as spam
campaigns, although cybersecurity experts fear
that larger botnets could be used “to launch
CyberPro
Hathaway Joins Kennedy School as Senior
Adviser
Melissa Hathaway has joined Harvard Kennedy
School’s Belfer Center for Science and
International Affairs as a senior advisor to its
cybersecurity initiative. Hathaway will focus on
developing an “understanding of policy gaps in
international relations as it relates to
cybersecurity.” Hathaway says that there are
several international venues determining the
future of the information communications
infrastructure, and that the United States needs
to determine what it needs and wants, as well
as how to better foster public and private
shared goals. Hathaway previously served at the
White House as acting senior director for
cybersecurity at the National Security Council
and also served as cyber coordination executive
and director of the Joint Interagency Cyber Task
Force within the Office of the Director of
National Intelligence.
http://www.govinfosecurity.com/articles.php?a
rt_id=1843
Cyber Security: California to Join U.S. Cyber
Challenge
AMERICAN CHRONICLE
10/05/2009
U.S. Senator Dianne Feinstein (D-Calif.) and the
California Office of Information Security
recently announced that California will
participate in the U.S. Cyber Challenge, a
competition aimed at recruiting American
cybersecurity experts. The challenge includes a
Digital Forensics competition, a CyberPatriot
ph. (757) 871-3578
P a g e | 15
CyberPro
October 22, 2009
Defense Competition and a NetWars Capture
the Flag Competition – all which will
helpidentify 10,000 young Americans who have
advanced computer skills. The program gives
these young Americans access to advanced
education and exercises and enables them to be
recognized by colleges and employers.
Feinstein, chairman of the Senate Intelligence
Committee, says that the United States needs a
new generation of skilled cybersecurity
professionals to combat attacks that threaten
our national security and economic well-being.
California, Delaware and New York are the only
states to “assemble the state and national
leadership, university partnership and private
sector business interest to begin developing
curriculum, online education modules,
exercises, software and scoring systems.”
http://www.americanchronicle.com/articles/vie
w/122264
Recruiting 11,000 IT Workers
BY: BRITTANY BALLENSTEDT, NEXTGOV.COM
10/14/2009
The partnership for Public Service is launching a
new program – FedRecruit: IT Pilot Program –
designed to recruit, hire and retain entry-level
information technology workers in the federal
government. Agencies participating in the IT
portion of the program will have the
opportunity to explore leading practices and
refine college and university recruitment,
improve application, hiring and onboarding
applications and develop metrics for
recruitment and hiring efforts. To qualify for
participation, agencies must have experienced
recruitment challenges in related positions and
must be willing to monitor and measure the
results of the program.
http://wiredworkplace.nextgov.com/2009/10/r
ecruiting_11000_new_it_workers.php
CyberPro
CIA Building Secure Cloud-Based System
BY: PATRICK THIBODEAU, COMPUTERWORLD
10/19/2009
Jill Tummler Singer, the CIA’s deputy CIO, says
that the agency is adopting cloud computing
and believes that cloud technology will make
“IT environments more flexible and secure.”
The CIA has been building a cloud-friendly
infrastructure for some time, but recently
decided to widely adopt cloud computing.
Singer explains that the agency’s widelydeployed virtualization technology laid the
foundation for the adoption of cloud
computing. Singer also says that cloud
computing improves security by reducing
complexity and making it faster to distribute
security patches. The CIA will keep its data in
private enclaves that are protected by
encryption, security and audits. Singer also says
that the CIA will not use Apps.gov as part of its
cloud computing program and will keep secret
and classified information within the agency’s
firewalls.
http://www.networkworld.com/news/2009/10
1909-cia-building-secure-cloud-based.html
NASA Systems and Data Vulnerable to
Hackers, Malicious Employees
BY: ALIYA STERNSTEIN, NEXTGOV.COM
10/16/2009
A recent report from the Government
Accountability Office found that NASA centers
do not properly restrict access to legitimate
users and that NASA centers have not applied
patches on a number of outside applications.
NASA reported 839 malicious code attacks for
fiscal 2007-2008, the highest of any federal
agency. NASA has admitted that a laptop was
stolen that contained information subject to
International Traffic in Arms Regulations and, in
February, GAO found that 82 NASA servers
were communicating with a malicious server,
most likely in Ukraine. GAO says that NASA’s
greatest vulnerabilities were a lack of effective
ph. (757) 871-3578
P a g e | 16
CyberPro
October 22, 2009
passwords, coding of sensitive information,
monitoring of security events and physical
security. GAO has recommended that NASA
tighten their security controls and develop a
comprehensive information security program.
6_8808.php
Cyberwar Readiness Recast as Low Priority
BY: J. NICHOLAS HOOVER, INFORMATION WEEK
10/12/2009
A report from RAND Corporation said that the
U.S. government should not make cyberwarfare
a priority investment area. The report says that
the government should focus instead on
defending the nation’s critical infrastructure.
The report explains that unlike in traditional
warfare, countries often respond to cyber
attacks by hardening their defenses and making
themselves less vulnerable. Cyber attacks are
also difficult to trace and difficult to retaliate
against. The report did say that operational
cyberwar capabilities could contribute to
warfare, would be relatively inexpensive and
are worth developing.
http://www.informationweek.com/news/gover
nment/security/showArticle.jhtml?articleID=22
0600297
CyberPro
FBI Takes to Planes in Global Fight Against
Cybercrime
BY: ANDREW MITCHELL, FEDERAL NEWS RADIO
10/07/2009
Supervisory Special Agent Patrick Carney,
assistant section chief of the FBI’s Cyber
Division Cybercriminal Section, says that the FBI
now has highly-trained experts who “jump onto
planes to respond to fast-moving threats” at a
moment’s notice. These teams of special
agents, forensic examiners, analysts and other
experts could be deployed where there are
cyber incidents, so that the FBI can “put a lot of
resources on the ground all at once.”
Cyberattacks often originate from outside of
the United States, so there needs to be a
“significant presence of U.S. law enforcers and
technical experts in the country from which the
attack is being made.” Carney says that the FBI
is working with international law enforcement
agencies that are usually cooperative if they
understand their own cyber vulnerabilities.
http://www.federalnewsradio.com/?nid=35&si
d=1780436
ph. (757) 871-3578
P a g e | 17
CyberPro
October 22, 2009
U.S. CYBER LEADERSHIP DEBATE
Hacker Jeff Moss: Inter-Agency Turf War
Plague Cybersecurity Effort
MXLOGIC.COM
10/16/2009
DefCon founder Jeff Moss says that U.S.
cybersecurity efforts have suffered because of
“turf battles and competition” between the
Department of Homeland Security and the
National Security Agency. Moss explains that
NSA’s role in protecting U.S. cyberspace has
made it more difficult for DHS to develop its
own efforts to protect government computer
CyberPro
networks. Moss also recommends using social
networks such as Twitter or MySpace for
distributing information about terrorist attacks
or national emergencies to civilians. Finally,
Moss believes that the White House cyber czar
could act as a coordinator between the
intelligence agencies, military and civilian
agencies.
http://www.mxlogic.com/securitynews/websecurity/hacker-jeff-moss-interagency-turf-warplagues-cybersecurity-effort915.cfm
ph. (757) 871-3578
P a g e | 18
CyberPro
October 22, 2009
CYBERSPACE – DEPARTMENT OF DEFENSE (DOD)
U.S. Cyber Command Now Fully Online,
and Seeking a Few Good Geeks
BY: JEREMY HSU, POPSCI
10/05/2009
The U.S. Cyber Command went live last
Thursday, and hopes to recruit at least 1,000
cyber security experts over the next few years.
The command must still answer questions
about its mission and responsibilities, and will
also have to compete for recruits from U.S.
intelligence agencies. It is unclear whether the
Cyber Command will help to defend U.S.
infrastructure in general or focus on defending
military networks. The current director of the
National Security Agency will become head of
the Cyber Command, although no plan has been
released about how he will perform both jobs.
http://www.popsci.com/military-aviation-ampspace/article/2009-10/us-cyber-command-nowonline-and-seeking-few-good-geeks
DARPA, Microsoft, Lockheed Team Up to
Reinvent TCP/IP
BY: LEWIS PAGE, THE REGISTER
10/16/2009
Lockheed Martin recently announced that it
received a $31 million contract from DARPA to
“reinvent the Internet and make it more
suitable for military use.” The project will focus
on developing a new Military Network Protocol
which will feature improved security,
bandwidth allocation and policy-based
prioritization levels. Lockheed will work with
Juniper Networks, LGS Innovations, Stanford
University and Microsoft to develop the Military
Network Protocol. Lockheed Martin will also
work to develop router technologies, including
strong authentication and self configuration
capabilities for better security and to lower
overall lifecycle costs for network management.
http://www.theregister.co.uk/2009/10/16/darp
a_microsoft_reinvent_internet/
CyberPro
Pentagon Officials Stress Cybersecurity
BY: JIM GARAMONE, DEFENSE LINK
10/15/2009
Pentagon officials stress that no matter what
computer you use, you need to take
cybersecurity into account. The Defense
Department is one of the largest computer
users in the world, and security has to be in the
forefront of all users, officials say.
Cybersecurity doesn't just happen; the threats
change, the software changes, the
sophistication of the threat changes and the
defenses change. Nothing remains static in
cyberspace, so if you had computer defenses
that worked two years ago, they likely won’t
work today.
http://www.defenselink.mil/news/newsarticle.
aspx?id=56246
Pentagon Backs Off Cloud Availability
Claims
BY: CAROLYN DUFFY MARSAN, NETWORK WORLD
10/08/2009
A U.S. Defense Department spokesman says
that the agency is working towards 99.99
percent availability on its new cloud computing
service, called Rapid Access Computing
Environment (RACE). Henry Sienkiewicz,
Technical Program Director of DISA’s Computing
Services and RACE Team, says that he misspoke
when he said that availability was at 99.99
percent, and that RACE will provide both
security and reliability to DISA’s military
customers. Best practices for information
security from the Defense Department have
been built into the RACE infrastructure, and
even with only “four-nines of availability”
currently, DISA’s cloud computing environment
is more reliable than some commercial offerings
such as Google.
0809-pentagon-backs-off-cloud.html
ph. (757) 871-3578
P a g e | 19
CyberPro
October 22, 2009
How DoD’s Bob Lentz Changed the Role of
Chief Information Security Officer
BY: DOROTHY RAMIENSKI, FEDERAL NEWS RADIO
10/13/2009
Lewis Shepherd, former senior technology
officer at the Defense Intelligence Agency, says
that Robert Lentz, long-time chief information
security officer at the Defense Department,
“professionalized and improved the degree of
information assurance at DoD and in the
national intelligence community.” Shepherd
says Lentz was focused on risk mitigation and
management, not risk avoidance. Lentz also
reached out to the private sector and Silicon
Valley on information security, which was
unprecedented. Shepherd added that Lentz
significantly improved the partnership between
the defense community and the Defense
Department.
d=1785032
U.S. Navy Creates Command to Maintain
Cyber Supremacy
SPACE WAR
10/02/2009
Naval intelligence Chief Vice Admiral Jack
Dorsett says that the Navy is creating an
“Information Dominance Corps” which will
expand the Navy’s cyberworkforce and
consolidate “intelligence gathering and other
data capabilities under a single command.”
Chief of Naval Operations Admiral Gary
Roughead explains that the reorganization will
bring intelligence, electronic warfare,
encryption operations, cyberspace
communications and information gathering
under the single Fleet Cyber Command. The
reorganization will be complete by the end of
this year and will be led by a director of
information dominance. Dorsett is currently a
nominee for the post and says that the United
States’ competitive information advantage is at
risk from adversaries like China and Russia.
CyberPro
http://www.spacewar.com/reports/US_Navy_c
reates_command_to_maintain_cyber_suprema
cy_999.html
The Information Dominance Corps
BY: BOB BREWIN, NEXTGOV.COM
10/14/2009
Beginning Oct. 6, a new Navy Information
Dominance Corps was created to "more
effectively and collaboratively lead and manage
a cadre of officers, enlisted and civilian
professionals who possess extensive skills in
information-intensive fields," said Adm. Gary
Roughead, chief of naval operations. Roughead
estimates that the new corps will eventually
have 45,000 military and civilian personnel
under its command who will receive extensive
training, education and work experience in
information, intelligence, counterintelligence,
human-derived information, networks, space
and oceanographic disciplines.
http://whatsbrewin.nextgov.com/2009/10/intr
oducing_information_dominance_corps.php
Fort Meade to be Cyber Defense Home
BY: RYAN JUSTIN FOX, HOMETOWN ANNAPOLIS
10/12/2009
The Navy recently announced plans to establish
its new cyber security division at Fort George G.
Meade, which consolidates the Navy’s data
defense and intelligence gathering into one
division. The new Fleet Cyber Command will
help to combat computer attacks. The Fleet
Cyber Command will focus on electronic
warfare, encryption, cyber communications and
meteorology and oceanography operations. The
Cyber Command could make Fort Meade the
“military-focused version of Silicon Valley.”
Pentagon spokesman Lt. Col. Eric Butterbaugh
says that Fort Meade is also the preferred
location for the U.S. Cyber Command.
http://www.hometownannapolis.com/news/to
p/2009/10/12-14/Fort-Meade-to-be-cyberdefense-home.html
ph. (757) 871-3578
P a g e | 20
CyberPro
October 22, 2009
Yep, Computers for Offensive Ops
BY: BOB BREWIN, NEXTGOV.COM
10/07/2009
The Air Force Electronic Systems Center says it
wants to “develop a Cyber Integration
Environment for the Cyber Command HQ and
other information operational outfits in the San
Antonio area,” including acquisition, integration
and sustainment for Air Force computer
network defense and computer network attack
capabilities. The article discusses how the Air
Force is developing the offensive capabilities to
attack adversaries online if necessary.
http://whatsbrewin.nextgov.com/2009/10/yep
_computers_for_offensive_ops.php
Air Force Activates New Cyberspace
Defense Unit
BY: AMBER CORRIN, FEDERAL COMPUTER WEEK
10/06/2009
The Air Force recently activated the new 689th
Combat Communications Wing at Robins Air
Force Base, Ga. The wing will specialize in
deployed communications to support the Air
Force’s Space Command, which includes both
space and cyber-space operations. Maj. Gen.
Richard Webber, commanding general of the
CyberPro
24th Air Force, says that the CCW is one of
three new sub-organizations that will support
the 24th Air Force, including the 688th
Information Operations Wing and the 67th
Network Warfare Wing. The CCW will be
commanded by Col. Theresa Giorlando and will
include around 6,000 active duty, reserve and
National Guard airmen.
http://fcw.com/articles/2009/10/06/cybercommand-unit-activated-under-spacecommand.aspx
Keesler AFB Begins Cyber Warfare Training
BY: JEFF LAWSON, WLOX
10/05/2009
Earlier this month, airmen began taking classes
on cyber warfare at Keesler Air Force Base, the
official cyber training headquarters for the Air
Force. The 95 airmen that began classes Oct. 5
will spend the next six months in training and
will then be stationed around the world to
defend the Air Force’s networks. Keesler will
train approximately 4,500 students in cyber
warfare this year.
http://www.wlox.com/Global/story.asp?S=1126
1989
ph. (757) 871-3578
P a g e | 21
CyberPro
October 22, 2009
CYBERSPACE – DEPARTMENT OF HOMELAND SECURITY (DHS)
DHS Web Sites Vulnerable to Hackers, IG
Says
BY: ALICE LIPOWICZ, FEDERAL COMPUTER WEEK
10/09/2009
A recent report from DHS Inspector General
Richard Skinner found that some of the
Homeland Security Department’s most popular
Web sites may be vulnerable to attacks. The
audit found that security protocols were
generally followed, but that there were gaps in
security, including inconsistent management of
security patching and security assessments. In
his report, Skinner wrote that DHS needs to
make improvements to its system inventory and
provide technical oversight and guidance to
better evaluate security threats. Skinner also
said that because DHS has more than 125 Web
sites accessible by the public, they are a bigger
target for attacks and hackers.
http://fcw.com/articles/2009/10/09/dhs-websites-vulnerable-to-hackers-ig-says.aspx
CYBERSPACE – INTERNATIONAL
Cyberwar: Sooner or Later, or Now
SECURITY
10/06/2009
At the International Telecommunications
Union’s Telecom World 2009 in Geneva, ITU
Secretary General Hamadoun Toure says that
the next world war could take place in
cyberspace where there are no superpowers
and where loss of vital networks could cripple
any nation. U.S. Army Lt. Col. Gregory Conti says
that cyberwarfare is not as evident as
conventional war, and says that cyberwar is
“ongoing now.” Conti says that there needs to
be a fourth military branch for cyberspace that
would be equal to the Army, Navy and Air
Force. Conti believes that the existence of a
cyber military branch would provide the United
States with defense capabilities and the ability
to conduct offensive operations. Conti also says
that the existence of a cyber military branch
would be a strong deterrent for our enemies.
http://blogs.govinfosecurity.com/posts.php?po
stID=319
CyberPro
IMPACT Boss Warns of Long Struggle with
Cyber Crime
BY: ROBIN HICKS, FUTUREGOV
10/14/2009
Datuk Mohd Noor Amin, chairman of the
International Multilateral Partnership Against
Cyber Threats (IMPACT), warns governments of
the long-term struggle with cyber criminality
and the need for international cooperation to
fight it. IMPACT was formed less than a year
ago, serves as the United Nations’ global cyber
security unit and currently has 191 countries as
member states. Amin says more states should
look to set up dedicated agencies to mitigate
the growing dangers of cyber threats and more
should be done by governments to ensure that
individual agencies talk to one another about
cyber crime issues.
http://www.futuregov.net/articles/2009/oct/14
/cyber-security-guru-warns-long-struggle-cybercrim/
ph. (757) 871-3578
P a g e | 22
CyberPro
October 22, 2009
National Cybersecurity Agencies Most
Effective Against Cyber Attacks: IMPACT
Chairman
DARK READING
10/13/2009
The International Multilateral Partnership
Against Cyber-Terrorism (IMPACT) says that
governments around the world need to create
dedicated agencies to address the dangers of
cyber threats. Singapore recently announced
the foundation of a cybersecurity authority –
the Singapore Infocomm Technology Security
Authority (SITSA) – and the United Kingdom
recently established the Centre for Secure
Information Security (CSIT). Abu Dhabi and
South Korea are also in the process of creating
cyber security agencies. Eugene Kaspersky, CEO
of Kaspersky Lab and member of IMPACT’s
International Advisory Board, says governments
are only just beginning to form regulations for
dealing with potential online threats. Kaspersky
Lab and other cybersecurity players provide
IMPACT’s Global Response Centre (GRC), the
group’s cyber threat resource, which provides
tracking and defenses against cyber threats
with real-time analysis and dissemination of
cyber threat information.
http://www.darkreading.com/security/vulnerab
ilities/showArticle.jhtml?articleID=220600682
U.N. Warns the Next World War will be
Online
BY: IAIN THOMSON, V3.CO.UK
10/07/2009
Hamadoun Toure, head of the U.N.
International Telecommunications Union, says
the countries are becoming increasingly
dependent on the Internet, and that future
wars could take place online, allowing weaker
nations to fight on a level playing field with
larger powers. Cyber attacks against Estonia
and Georgia have made governments more
aware of their online defenses. Cristine
Hoepers, general manager of the Brazilian
CyberPro
National Computer Emergency Response Team,
says that poorly-written software is still a major
vulnerability.
http://www.v3.co.uk/v3/news/2250716/unwarns-world-war-online
U.S. Gen. Urges More Effort Against Cyber
Attacks
DEFENSE NEWS
10/19/2009
Lt. Gen. Jeffrey Remington, commander of the
U.S. Air Force in South Korea, recently told a
forum in Seoul that the United States and South
Korea must defend their military computer
networks against increasingly sophisticated
online attacks. Remington says that the military
cannot afford to have its systems disconnected
during conflicts. South Korea and the United
States have agreed to cooperate in fighting
cyber attacks from countries such as China and
North Korea. This article also discusses recent
attacks and threats that originated in North
Korea, including recent reports that North
Korean hackers gained access to a South Korean
government computer system in March,
stealing confidential data on toxic chemicals.
http://www.defensenews.com/story.php?i=433
0880
State to Award Social Networking Grants in
Middle East, Africa
BY: GAUTHAM NAGESH, NEXTGOV.COM
10/09/2009
The U.S. State Department recently announced
that it will award five organizations grants to
help expand the availability of social networking
and media capabilities in the Middle East and
North Africa. The program is being sponsored
by the Middle East Partnership Initiative, which
is part of the Bureau of Near Eastern Affairs at
the State Department. The department has said
priority will be given to applications that
propose the use of existing social media
platforms to improve the ability of Middle
ph. (757) 871-3578
P a g e | 23
CyberPro
October 22, 2009
Eastern citizens to communication and
exchange information with one another. Henry
Farrell, associate professor of international
affairs at George Washington University,
explains that the project is an example of how
the United States is attempting to increase
democracy in less confrontational ways than it
has in the past, although some countries could
see the program as meddling.
http://www.nextgov.com/welcome/?d=15&rf=
http%3A%2F%2Fwww.nextgov.com%2Fnextgov
%2Fng_20091009_9389.php
EU Signs Up New Cyber-Security Boss
BY: IAN WILLIAMS, THE INQUIRER
10/16/2009
The European Union recently appointed Dr. Udo
Helmbrecht as the executive director of the
European Network and Information Security
Agency (ENISA). Helmbrecht says he will help
ENISA work more closely with other European
institutions and member states to improve
electronic security throughout Europe.
Helmbrecht says that the “economy of Europe
is at stake” if cybersecurity is not properly
managed, and emphasizes the importance of
promoting cybersecurity to citizens. Helmbrecht
has also said that he will push for more
cooperation and dialogue between security
stakeholders, and hopes that the agency will
have an impact on cybersecurity laws and
regulations in member states.
http://www.theinquirer.net/inquirer/news/155
8893/eu-signs-cyber-security-boss
Polish Government Cyberattack Blamed on
Russia
BY: JOHN LEYDEN, THE REGISTER
10/13/2009
While details are scarce, an unsuccessful cyber
attack on Polish government systems last
month may have originated in Russia. The
attacks may have coincided with the 70th
anniversary of World War II, and the attacks
CyberPro
also took place at the same time that Russian
Prime Minister Vladimir Putin visited Poland.
http://www.theregister.co.uk/2009/10/13/pola
nd_cyberattacks/
‘Hack Idol’ To Find Top UK Cyberwarriors
BY: JOHN LEYDEN, THE REGISTER
10/12/2009
The United Kingdom government has
announced plans to find the "best young
hackers" through a talent competition that will
rate individuals on their abilities to thwart
attacks and hack into Web sites. The scheme
resembles the much larger U.S. Cyber Challenge
program, which is seeking 10,000 young
Americans with the skills to fill the ranks of
cyber security practitioners, researchers and
warriors.
http://www.theregister.co.uk/2009/10/12/hack
_idol/
S. Korea’s Classified Information
Withdrawn via Hacking: Official
YONHAP NEWS
10/17/2009
South Korean government officials believe that
hackers from North Korea broke into the South
Korean Chemicals Accident Response
Information System and stole classified
information on dangerous chemicals. The
system is used by 589 South Korean
government agencies, and was broken into last
March using the ID of a South Korean army
officer whose personal computer was infected
with a virus. An official at Seoul’s environment
ministry says they are trying to find out how
much information has been withdrawn from
the system, and intelligence sources in Seoul
say that North Korea has a cyber warfare unit
that focuses on disrupting South Korean and
U.S. military networks.
http://english.yonhapnews.co.kr/national/2009
/10/17/69/0301000000AEN2009101700130031
5F.HTML
ph. (757) 871-3578
P a g e | 24
CyberPro
October 22, 2009
Report: NKorea Hackers Steal SKorea Toxic
Secrets
THE SYDNEY MORNING HERALD
10/17/2009
This article discusses how a North Korean cyber
warfare unit hacked into a South Korean
military command early this year, using a stolen
password and stole national secrets including
information on toxic chemical makers. The
National Institute of Environmental Research,
who established the database that was
attacked, disconnected the army command a
day after the attacks. Information about 700
local toxic chemical manufacturers was leaked
during the breach. The hackers may have gotten
the password to the system when an army
colonel’s computer was infected with a virus.
http://news.smh.com.au/breaking-newstechnology/report-nkorea-hackers-steal-skoreatoxic-secrets-20091017-h20z.html
CISCO
Cisco (NASDAQ: CSCO) enables people to make powerful
connections-whether in business, education, philanthropy,
or creativity. Cisco hardware, software, and service
offerings are used to create the Internet solutions that
make networks possible-providing easy access to
information anywhere, at any time. Cisco was founded in
1984 by a small group of computer scientists from Stanford
University. Since the company's inception, Cisco engineers
have been leaders in the development of Internet Protocol
(IP)-based networking technologies.
Today, with more than 65,225 employees worldwide, this
tradition of innovation continues with industry-leading
products and solutions in the company's core development
areas of routing and switching, as well as in advanced
technologies such as: Application Networking, Data Center,
Digital Media, Radio over IP, Mobility, Security, Storage
Networking, TelePresence, Unified Communications, Video
and Virtualization. For additional information:
www.cisco.com
CYBERSPACE RESEARCH
Gartner: Loosen Up on Social Networks,
Security
BY: STEPHEN SHANKLAND, CNET NEWS
10/19/2009
Carol Rozwell, a Gartner vice president, says
that it is impossible to completely block social
networking from corporate networks. Rozwell
says that humans are social creatures and that
social networks make employees feel more
CyberPro
valued and “part of a community.” Educating
employees about their responsibilities on social
networking sites is essential. Peter
Sondergaard, senior vice president of research
at Gartner, says that companies need to
understand that they cannot control everything
and that we are moving towards great
autonomy. Paul Proctor, another Gartner vice
president, says that companies must learn to
ph. (757) 871-3578
P a g e | 25
CyberPro
October 22, 2009
balance risk and performance especially when it
comes to new technologies, such as cloud
computing.
http://news.cnet.com/8301-30685_310377642-264.html
investigations after a security incident has
occurred.
d=1787573
Classic Cyber Crimes Could Pose Future
Threats
U.S. Must Focus on Protecting Critical
Computer Networks from Cyber Attack,
Experts Urge
BY: SHAUN NICHOLS, V3.CO.UK
10/08/2009
SCIENCE DAILY
10/09/2009
McAfee Labs threat researcher Craig Schmugar
and product manager Anthony Bettini discuss
how classic cyber crimes such as market
manipulation and social engineering could
become the biggest security threats in the
future. The emergence of new Web 2.0 services
and speeds is giving new life and sophistication
to classic online crimes. Cyber criminals are also
using Web 2.0 capabilities to improve phishing
scams, since more information is available
online allowing criminals to make more
personalized attacks.
http://www.v3.co.uk/v3/news/2250818/avenu
es-emerging-old-cybercrime
A recent RAND Corporation report says the
United States must focus on defending its
networks from cyber attacks, since preventing
attacks by threatening punishment to attackers
is difficult. Martin C. Libicki, senior management
scientist at RAND, says that lessons from
traditional warfare cannot always be adapted to
attacks on computer networks, and that cyber
attacks must be addressed in new terms. Libicki
explains that it is difficult to estimate the
amount of damage that an attack could do, and
it is also difficult to find the source of a cyber
attack, which makes it almost impossible to
counterattack. Libicki recommends that the
United States “pursue diplomatic, economic
and prosecutorial efforts against cyber
attackers.”
http://www.sciencedaily.com/releases/2009/10
/091008113339.htm
Cybersecurity Provider Says Most Agencies
Have Already Been Attacked
BY: EMILY JARVIS, FEDERAL NEWS RADIO
10/19/2009
Solera Networks recently released a network
forensics survey that found that more than 85
percent of companies have had some major
network incident in the past 36 months, and
that 92 percent of the companies surveyed
think it is important to have network forensics
capabilities to capture and record network
traffic. Only 28 percent of the companies said
they were familiar with network forensic
solutions and 24 percent said they had no
effective incident response plan in place. Steve
Shillingford, Solera Networks president and
CEO, says that Solera provides solutions for
companies that collect traffic coming in and out
of company networks, and improves incident
CyberPro
Cyber Terrorism Demands New Tactics:
Study
BY: LARRY BARRETT, INTERNET NEWS
10/09/2009
A study from RAND Corporation, called
“Cyberdeterrence and Cyberwar,” says that the
United States needs to improve their
cybersecurity efforts and develop a
comprehensive plan to fight cyber terrorism.
Martin Libicki, the report’s lead author and
senior management scientist at RAND, says that
lessons from traditional warfare cannot be
applied to cyber warfare and that future
conflicts will likely always include attacks on
ph. (757) 871-3578
P a g e | 26
CyberPro
October 22, 2009
information systems. Libicki also discusses how
it is difficult to determine how destructive a
cyber attack would be, and the attacker’s
motives may be unknown. The RAND study says
that the United States must pursue diplomatic,
economic and prosecutorial efforts against
cyber criminals rather than make strategic
cyber warfare the priority investment, since
attribution is often impossible and since there is
often no opportunity to counterattack once the
damage has been done.
http://www.internetnews.com/security/article.
php/3843136
Study: U.S. Should Focus on Protecting
Critical Computer Networks
BY: KIM MAYS, IT BUSINESS EDGE
10/08/2009
The Rand Corporation recently released a study
that says the United States needs to focus on
defending critical civilian and military computer
networks from cyber attacks because of our
reliance on computer networks for electric
power, banking, military command and
telephone service. Martin C. Libicki, Rand’s
senior manager, says that adversaries are likely
to go after each other’s information systems
and that lessons from traditional warfare
cannot always be adapted to cyber attacks.
Libicki also says that the inability to track cyber
attacks to a specific person or group also makes
it more difficult to launch a cyberattack.
http://www.itbusinessedge.com/cm/communit
y/news/sec/blog/study-us-should-focus-onprotecting-critical-computernetworks/?cs=36496
SSL Still Mostly Misunderstood
BY: KELLY JACKSON HIGGINS, DARK READING
10/07/2009
Tyler Reguly, senior security engineer for
nCircle, recently shared the results of an nCircle
survey at a panel presentation about SSL at the
SecTor Conference in Toronto. Reguly says that
CyberPro
the survey found 83 percent of users check that
they are using an SSL-secured session before
entering their credit card information online,
but only 41 percent check that they are using an
SSL-secured session before entering their
passwords. Researcher Mike Zusman also spoke
on the panel and said it’s not just the general
consumer population that doesn’t understand
SSL, but that it is also still a challenge in the
infosec community. More than half of the
respondents in the nCircle survey did not know
how Extended Validation SSL (EVSSL) differs
from SSL. The researchers say that nearly 50
percent of the respondents admit to clicking
through SSL notifications when a site they are
visiting has an invalid or expired SSL certificate,
and that finding a way to better deploy SSL
might make it more effective.
Enterprises Confident in Defenses Against
External Attacks, Study Says
BY: TIM WILSON, DARK READING
10/07/2009
According to a recent study by IDC and
commissioned by Dimension Data, 85 percent
of IT managers believe their organizations will
not lose data through external hacking and
more than 60 percent say that they believe
their organizations will not be affected by virus
attacks. The study found that 45 percent of the
IT managers thought that data leakage was
more likely to occur through employee errors.
The report also says that larger organizations
are more compliant than smaller companies
and that 41 percent of the companies surveyed
are cutting their IT spending due to the
economic downturn.
ph. (757) 871-3578
P a g e | 27
CyberPro
October 22, 2009
CYBERSPACE HACKS AND ATTACKS
How Hackers Find Your Weak Spots
Gumblar Botnet Awakens After Five
Months to Distribute Malware
BY: MARY BRANDEL, COMPUTERWORLD
10/19/2009
This article discusses typical social engineering
exploits. Hackers will often use information
from social networking profiles to guess a
victim’s password reminder question; this is
how hackers broke into Sarah Palin’s e-mail.
Hackers also gain the trust of their victims and
then trick them into clicking on malicious links.
Hackers may impersonate another person
online, and then ask their victims to provide
them with information. Netragard CTO Adriel
Desautels says that hackers also pose as IT help
desk workers or contractors, and that almost 90
percent of people were successfully exploited in
vulnerability assessments where Netragard
workers posed as employees from their same
company.
http://www.computerworld.com/s/article/3439
00/How_Hackers_Find_Your_Weak_Spots
BY: DAN RAYWOOD, SC MAGAZINE UK
10/16/2009
Mary Landesman, senior security researcher at
ScanSafe, reports that the Gumblar botnet is
using compromised Web sites were originally
infected in May as hosts for its malware.
Landesman says that the malware is on
thousands of legitimate, but compromised,
Web sites – most of which are small business
sites in non-English speaking countries. The
malicious script checks for the version of Adobe
Reader and Adobe Flash, and also includes an
exploit for the Microsoft Office Web
Components vulnerability that was patched in
August 2009. ScanSafe says that the signature
detection of the malware is still very low.
http://www.scmagazineuk.com/Gumblarbotnet-awakens-after-five-months-todistribute-malware/article/154889/
Fake Security Software in Millions of
Computers: Symantec
With Botnets Everywhere, DDoS Attacks
Get Cheaper
THE WASHINGTON POST
10/19/2009
BY: ROBERT MCMILLAN, COMPUTERWORLD
10/14/2009
A new Symantec report on cybercrime found
that criminals are increasingly planting fake
security alerts on legitimate Web sites, warning
users of a fake virus and offering them security
software which actually infects their machines.
Vincent Weafer, Symantec’s vice president for
security response, says that victims of these
scams give their credit card numbers and
personal information to the criminals. Symantec
has identified 250 varieties of scam security
software and estimate the number of infected
machines to be in the tens of millions.
http://www.washingtonpost.com/wpdyn/content/article/2009/10/19/AR200910190
0096.html
Jose Nazario, a security researcher with Arbor
Networks, says that the cost of criminal
services, such as distributed-denial-of-service
attacks, has dropped in recent months due to a
flood of botnets on the market. Criminals are
becoming better at hacking into computers and
forming botnets, making it cheaper to rent
criminal services. SecureWorks security
researcher Kevin Stevens says that the cost of
stolen credit card information and other
personal information has also dropped
dramatically.
398/With_botnets_everywhere_DDoS_attacks_
get_cheaper?source=rss_security
CyberPro
ph. (757) 871-3578
P a g e | 28
CyberPro
October 22, 2009
Phishing Attacks with Zeus Trojan
Targeting Outlook Webmail Shops
Malware Posing as Postal Tracking E-Mail
BY: CASEY MAYVILLE, GOVTECH
10/14/2009
BY: ELLEN MESSMER, NETWORK WORLD
10/15/2009
Mickey Boodaei, CEO of security firm Trusteer,
reports that targeted phishing attacks aimed at
Outlook Web Access users are spreading fast.
Victims of the attack are receiving e-mails that
appear to be from within their enterprise, and
are tricked into modifying their e-mail setting
for Outlook Webmail. The victims are taken to a
Web site that appears to be the enterprise
Outlook Web Access Site, but is actually a fake
site that tricks victims into downloading the
Zeus/Zbot Trojain. Trusteer recommends that
companies educate their employees about this
type of attack, and block downloads of
executable and zip files from the Web.
1509-phishing-zeus-outlook.html
CyberPro
This article discusses how the Bredlab Trojan, a
virus which is sent out by the Cutwail botnet, is
entering e-mail inboxes in the form of fake
purchase receipts of online orders. The subject
line of the malicious e-mails includes the order’s
postal tracking number and the e-mail contains
a zip file attachment which installs the virus on
to the computer if opened. The virus is usually
not detected and the criminals have complete
access to infected machines. MessageLabs
reports that spam from the Bredolab Trojan has
increased in recent months, currently
accounting for 3.5 percent of all spam and 5.6
percent of all malware intercepted each day.
http://www.govtech.com/gt/articles/731201
ph. (757) 871-3578
P a g e | 29
CyberPro
October 22, 2009
Is Phishing on the Decline, Or Just Moving
to a New Phishing Hole?
http://www.securitypark.co.uk/security_article
263749.html
BY: WILLIAM JACKSON, GOVERNMENT COMPUTER
NEWS
10/14/2009
Bahama Botnet Said to Steal Traffic From
Google
Major vendors, such as IBM and Symantec,
have reported downturns recently in the
number of phishing attacks. According to one
cyber intelligence and security company, recent
reports of the demise of phishing have been
greatly exaggerated. Cyveillance says
that even though phishing e-mail volume may
have fallen, the number of phishing attacks is
actually on the rise, through more sophisticated
methods and more focused e-mail campaigns as
evidenced by one of the highest three-month
volumes in phishing attacks ever detected from
June through August of this year.
http://gcn.com/articles/2009/10/12/cybereyebox-phishing-moves-to-new-spots.aspx
Hackers Plunder Bank Accounts at
Unsuspecting Small Businesses and School
Districts
SECURITY PARK
10/08/2009
The U.K. Federal Financial Institutions
Examination Council (FFIEC) is requiring banks
to allow customers to access their accounts only
if they provide at least one other identification
factor in addition to their passwords. Customers
could be asked to provide a password for
authentication as well as additional information
which can be something the customer “is,” such
as a fingerprint, or something the customer
“has,” such as a physical key. Melih
Abdulhayoglu, CEO of Comodo, says that
hackers are targeting small businesses and
injecting malicious executables into school
districts’ systems, stealing their bank account
information and stealing money. The FFIEC also
says that online users should make their
personal computers as secure as possible by
using firewall and antivirus software.
CyberPro
BY: JUAN CARLOS PEREZ, COMPUTERWORLD
10/08/2009
Click Forensics reports that the Bahama botnet,
which infects computers through click-fraud, is
stealing Web traffic and revenue from Google.
The Bahama botnet turns infected computers
into click-fraud perpetrators, undermining the
effectiveness of ad campaigns. The
compromised machines are taking their users to
a fake page in Canada that looks just like the
real Google, involving users in click-fraud scams
that steal traffic and ad revenue from Google.
The Bahama botnet is essentially robbing traffic
from major ad providers and routing it to
smaller providers. The Bahama botnet is set up
to make its rogue traffic appear legitimate,
allowing the botnet to trick the most
sophisticated traffic filters.
200/Bahama_botnet_said_to_steal_traffic_fro
m_Google?source=rss_security
Zeus Trojan Infiltrates Bank Security Firm
BRIAN KREBS, THE WASHINGTON POST
10/06/2009
Security industry start-up Silver Tail Systems,
who held an online seminar in September that
examined the Zeus Trojan horse program,
recently found out that the Trojan had
infiltrated its own network defenses. Laura
Mather, Silver Tail founder, says that the
company was targeted by the criminals behind
Zeus because of the recent webinar, and that
the criminals were unable to get any
information that could be valuable. The
criminals used a former employee’s Zeusinfected computer to run password-cracking
programs against administrator accounts on the
internal network. Mather says the former
ph. (757) 871-3578
P a g e | 30
CyberPro
October 22, 2009
employee had disabled the encryption
requirement on his machine which could have
been found through routine security auditing.
Mather says that Silver Tail could not find the
virus using three different anti-virus tools, but
had to use a manual search for files commonly
associated with Zeus variants.
http://voices.washingtonpost.com/securityfix/2
009/10/ubiquitous_zeus_trojan_targets.html
Users Hit by New Wave of SQL Attacks
BY: ROBERT MCMILLAN, TECHWORLD
10/05/2009
Gary Warner, director of research in computer
forensics with the University of Alabama, says
that the Asprox botnet network has come “back
to life” and is infecting computers again. The
network first gained attention in May and June
by infecting tens of thousands of Web pages on
more than 1,000 domains. Secure Works found
attacks from the network earlier this month
when they detected SQL injection attacks
against the company’s clients. SQL attacks take
advantage of database programming errors to
trick Web sites into posting attack code. Asprox
uses JavaScript code that generates an iFrame
that launches the attack code on the victim’s
computer.
http://news.techworld.com/security/3203184/
users-hit-by-new-wave-of-sql-attacks
Raytheon
Aspiring to be the most admired defense and aerospace systems
supplier through world-class people and technology Raytheon is
a technology leader specializing in defense, homeland security,
and other government markets throughout the world. With a
history of innovation spanning more than 80 years, Raytheon
provides state-of-the-art electronics, mission systems
integration, and other capabilities in the areas of sensing;
effects; command, control, communications and intelligence
systems, as well as a broad range of mission support services.
CYBERSPACE TACTICS AND DEFENSE
Comcast Takes Revolutionary Security Step
BY: IRA WINKLER, INTERNET EVOLUTION
10/19/2009
This article discusses how, for the first time, an
Internet Service Provider is taking actions to
mitigate bots that are serviced by its networks.
While most ISPs hide behind laws that say they
are not responsible for the actions of their
subscribers, Comcast Corp. has said that it will
take actions within its control to mitigate
botnets. The article explains how ISPs can see
the systems that are spreading thousands of
CyberPro
infected packets, making it easier to stop the
attacks.
http://www.internetevolution.com/author.asp?
section_id=515&doc_id=183242
Adobe Warns of Critical Threat to Reader,
Acrobat Users
BY: BRIAN KREBS, THE WASHINGTON POST
10/09/2009
Adobe Systems Inc. recently released an alert
which said that hackers are exploiting a new
vulnerability in its free PDF Reader and Acrobat
ph. (757) 871-3578
P a g e | 31
CyberPro
October 22, 2009
products which allow the hackers access to
Microsoft Windows systems. Adobe is planning
to release a patch and updates for Adobe
Reader and Acrobat to resolve critical security
issues. Adobe also says that disabling JavaScript
in Reader and Acrobat could help mitigate the
threat from this specific exploit, but not all
vulnerabilities.
http://voices.washingtonpost.com/securityfix/2
009/10/adobe_warns_of_critical_threat.html
Anti-Wi-Fi Paint Offers Security
BY: DAVE LEE, BBC NEWS
09/30/2009
Researchers say they have developed a special
kind of paint that could block out wireless
signals which could be used to keep
unauthorized users from accessing wireless
networks. The paint blocks wireless signals by
using an aluminum-iron oxide which resonates
at the same frequency as wi-fi, absorbing and
blocking the signals. Researchers say the paint
could be used for many things, including
blocking phone signals inside of a movie
theater, keeping cell phones from going off
during a movie. Mark Johnson, security
engineer at Cisco UK, says that electromagnetic
shielding techniques are nothing new, and
although they would block eavesdroppers on
wireless networks, it would not prevent other
types of hackers or intruders.
http://news.bbc.co.uk/2/hi/technology/827954
9.stm
Intelligent Software Solutions
ISS is a leading edge software solution provider for enterprise and system
data, services, and application challenges. ISS has built hundreds of
operationally deployed systems, in all domains – “From Space to Mud”™.
With solutions based upon modern, proven technology designed to
capitalize on dynamic service-oriented constructs, ISS delivers innovative
C2, ISR, Intelligence, and cyber solutions that work today and in the
future. http://www.issinc.com.
CYBERSPACE - LEGAL
Commerce Aide: Cybersecurity Bill Moving
BY: ANDREW NOYES, CONGRESSDAILY
10/19/2009
Senate Commerce Committee General Counsel
Bruce Andrews recently said legislation that
aims to help the government and private sector
prepare for and respond to cyber attacks
against communications infrastructure could
pass the Senate this year. The bill, introduced
by Senate Commerce Chairman John
Rockefeller and Sen. Olympia Snowe, has been
revised since its original introduction in April.
Homeland Security and Governmental Affairs
CyberPro
ranking member Susan Collins recently
announced she would introduce a measure that
would give the Homeland Security Department,
rather than the White House, primary
responsibility for protecting federal civilian and
private computer networks.
9_4371.php
ph. (757) 871-3578
P a g e | 32
CyberPro
October 22, 2009
Fed Regulation of Private Data Mulled
SECURITY
10/16/2009
Rep. Yvette Clarke, chairwoman of the House
Homeland Security Subcommittee on Emerging
Threats, Cybersecurity and Science and
Technology, says that Congress needs to enact
legislation that would allow the federal
government to regulate how the private sector
handles and stores information in order to
combat the increasing problem of data
breaches. The number of data breaches has
increased from 157 reported breaches in 2005
to 407 reported breaches so far in 2009. Clark
also says that the private sector should be
involved in creating the legislation, and that the
Homeland Security Committee could hold
hearings to hear from government officials,
business leaders and academics. Clark added
that the legislation would cover the way that
information is retrieved, transmitted,
intercepted and stored. Stanton Sloane, chief
executive officer of the information services
firm SRA International, says that government
regulations on the private sector could be
ineffective, and that the government may have
trouble enforcing compliance.
http://www.govinfosecurity.com/articles.php?a
rt_id=1867
Fugitive Hacker Headed Back to U.S. for
Arraignment
BY: SHARON GAUDIN, COMPUTERWORLD
10/15/2009
Edward Pena was arrested in June 2006 on
multiple computer and wire fraud charges, but
fled the country after he was released from jail
on $100,000 bail. Assistant U.S. Attorney Erez
Liebermann says that Pena, a fugitive for more
than three years, has been apprehended in
Mexico, and faces extradition to the United
States for his trial. Pena is facing 20 charges,
including conspiracy to commit computer
CyberPro
intrusion and conspiracy to commit wire fraud.
Pena and another man allegedly sold more than
10 million minutes of VoIP service stolen from
15 telecommunications providers. The criminals
broke into unsecured networks and then ran
brute force attacks to obtain the proprietary
codes needed to make and accept calls on the
network. Court documents claim that Pena
made more than $1 million from the scheme.
434/Fugitive_hacker_headed_back_to_U.S._for
_arraignment?source=rss_security
Delta Air Lines Sued over Alleged E-Mail
Hacking
BY: JEREMY KIRK, COMPUTERWORLD
10/14/2009
Kathleen Hanni, executive director of
Flyersrights.org, says that Delta Air Lines
illegally obtained sensitive e-mails and files and
then used the material in an attempt to stop
the “Airline Passenger’s Bill of Rights of 2009,”
pending before Congress. The lawsuit is seeking
a minimum of $11 million in damages.
Flyersrights.org is a nonprofit organization that
investigates surface delays in air travel. Hanni
claims that Delta intercepted communications
between the company and an employee of
Metron Aviation, which was hired to study
surface delays in air travel. Hanni claims that
her e-mails, spreadsheets and lists of donors
were redirected to an unknown destination. If
the bill was passed, the airlines could lose as
much as $40 million in revenue and be forced to
spend more on compliance.
343/Delta_Air_Lines_sued_over_alleged_e_mai
l_hacking?source=rss_security
NASA Hacker Makes Extra-Judicial Appeal
BY: CHUCK MILLER, SC MAGAZINE
10/12/2009
After being denied an appeal on Friday to argue
his case before the British Supreme Court, Gary
ph. (757) 871-3578
P a g e | 33
CyberPro
October 22, 2009
McKinnon, who faces extradition to the United
States for hacking into NASA computers, is
making a last-ditch appeal to the country's
Home Secretary based on his own deteriorating
health and the potentially devastating effect
extradition could have on him. McKinnon, 43, is
accused of hacking into 97 computers operated
by the U.S. government, including those of the
Pentagon, Army, Air Force and NASA.
Authorities report his actions resulted in a
shutdown of the Army’s Military District of
Washington network, containing more than
2,000 computers and resulting in $700,000 in
damage.
http://www.scmagazineus.com/NASA-hackermakes-extra-judicial-appeal/article/152118/
Operation Phish Phry Hooks 100 in U.S.
and Egypt
BY: JAIKUMAR VIJAYAN, COMPUTERWORLD
10/07/2009
U.S. authorities recently arrested 33 individuals
out of 50 that were indicted by a grand jury in
Los Angeles for stealing bank account
information from thousands of U.S. victims
through phishing attacks. Authorities in Egypt
charged an additional 47 co-conspirators in
connection with the same scheme. The
indictments are the result of a two-year
operation called “Phish Phry” which included
the FBI, the U.S. Attorney’s Office, the
Electronic Crimes Task Force in Los Angeles and
Egyptian law enforcement authorities. All of the
individuals indicted in the United States have
been charged with conspiracy to commit wire
fraud and bank fraud, and some of the
individuals are also charged with aggravated
identity theft, unauthorized access to protected
computers and money laundering. Hackers in
Egypt used phishing attacks to obtain bank
account numbers and personal information
from thousands of U.S. bank customers, and
then recruited the individuals in the United
States to help transfer the funds from the
compromised accounts to fraudulent U.S.
accounts.
093/Operation_Phish_Phry_hooks_100_in_U.S.
_and_Egypt
High Tech Problem Solvers
www.gtri.gatech.edu
From accredited DoD enterprise systems to exploits for
heterogeneous networks, GTRI is on the cutting edge of
cyberspace technology. Transferring knowledge from
research activities with the Georgia Tech Information Security
Center, GTRI is able to bring together the best technologies,
finding real-world solutions for complex problems facing
government and industry.
CyberPro
ph. (757) 871-3578
P a g e | 34
CyberPro
October 22, 2009
CYBERSPACE-RELATED CONFERENCES
Note: Dates and events change often. Please visit web site for details. Please provide additions, updates, and/or
suggestions for the CYBER calendar of events here.
28 – 29 Oct 2009
2 – 3 Nov 2009
4 – 5 Nov 2009
8 Nov 2009
11 Nov 2009
12 Nov 2009
12 Nov 2009
16 – 18 Nov 2009
17 – 19 Nov 2009
18 – 20 Nov 2009
28 Nov – 6 Dec
2009
3 Dec 2009
8 – 9 Dec 2009
11 – 18 Dec 2009
27 – 28 Jan 2010
17 – 18 Feb 2010
12 – 14 Mar 2010
18 – 19 Mar 2010
8 – 9 April 2010
23 April 2010
17 July 2010
Seattle SecureWorld Expo; Seattle, WA;
http://secureworldexpo.com/events/index.php?id=249
Midwest Information Security Forum, Chicago, IL;
https://www.isc2.org/EventDetails.aspx?id=5066
Dallas SecureWorld Expo; Dallas, TX;
http://secureworldexpo.com/events/index.php?id=250
SecureMuscat, Muscat, Oman;
https://www.isc2.org/EventDetails.aspx?id=4150&display=eventdetails&origin=
The Security 500 Conference, New York, NY;
http://www.securingnewground.com/Security500/default2.htm
SecureSydney, Sydney, Australia; https://www.isc2.org/EventDetails.aspx?id=4982
SecureHouston, Houston, TX; https://www.isc2.org/EventDetails.aspx?id=4086
Cyber Security for National Defense, Washington DC;
http://www.cybersecurityevent.com/Event.aspx?id=211620
PDCO9, Los Angeles, CA; https://www.isc2.org/EventDetails.aspx?id=5050
MINES 2009 International Conference on Multimedia Information Networking and
Security, Wuhan, China; http://liss.whu.edu.cn/mines2009/
SANS London 2009, London, UK; https://www.isc2.org/EventDetails.aspx?id=5078
SecureCharlotte, Charlotte, NC; https://www.isc2.org/EventDetails.aspx?id=4600
Pacific Information Security Forum, San Francisco, CA;
https://www.isc2.org/EventDetails.aspx?id=5068
SANS Cyber Defense Initiative 2009, Washington DC; http://www.sans.org/cyber-defenseinitiative2009/?utm_source=offsite&utm_medium=misc&utm_content=20090725_te_072509_cdi09
_allconf&utm_campaign=CDI_East_2009&ref=46324
Cyber Warfare 2010, London, UK; http://www.cyberwarfareevent.com/Event.aspx?id=228104
th
7 Annual Worldwide Security Conference, Brussels, Belgium;
http://www.conferencealerts.com/seeconf.mv?q=ca1m3m8x
th
5 Global Conference: Cybercultures – Exploring Critical Issues, Salzburg, Austria;
http://www.conferencealerts.com/seeconf.mv?q=ca1mx666
Cyber Security - Legal and Policy Issues for National Security, Law Enforcement and Private
Industry, San Antonio, TX;
http://www.stmarytx.edu/ctl/index.php?site=centerForTerrorismLawCyberSecurity
th
5 International Conference on Information Warfare and Security, Wright-Patterson Air
Force Base, Ohio; http://academic-conferences.org/iciw/iciw2010/iciw10-home.htm
Social Networking in Cyberspace, Wolverhampton, UK;
http://www.conferencealerts.com/seeconf.mv?q=ca1mhm38
Cyberpsychology and Computing Psychology Conference (CyComP 2010), Bolton,
Lancashire, UK; http://www.conferencealerts.com/seeconf.mv?q=ca1mxia6
CyberPro
ph. (757) 871-3578
P a g e | 35
CyberPro
October 22, 2009
CYBERSPACE-RELATED TRAINING COURSES
Certified Ethical Hacker
Global Knowledge, Dates and Locations:
http://www.globalknowledge.com/training/course.asp?pageid=9&courseid=104
63&catid=191&country=United+States
EC-Council, Online, http://www.eccouncil.org/Course-Outline/ECSP.htm
Certified Secure Programmer
(ECSP)
Certified VoIP Professional
CISA Prep Course
CISM Prep Course
CISSP Prep Course
Computer Hacking Forensic
Investigator
Contingency Planning
Cyber Law
Defending Windows Networks
DIACAP – Certification and
Accreditation Process
DIACAP – Certification and
Accreditation Process,
Executive Overview
Disaster Recovery
E-Business Security
E-Commerce Architect
ESCA/LPT
Ethical Hacking and
Countermeasures
EC-Council, Online, http://www.eccouncil.org/Course-Outline/ECVP.htm
EC-Council, Online, http://www.eccouncil.org/CourseOutline/CHFI%20Course.htm
EC-Council, Online, http://www.eccouncil.org/CourseOutline/CyberLaw%20Course.htm
EC-Council, Online, http://www.eccouncil.org/CourseOutline/Disaster%20Recovery%20Course.htm
EC-Council, Online, http://www.eccouncil.org/Course-Outline/eSecurity%20Course.htm
EC-Council, Online, http://www.eccouncil.org/Course-Outline/ECommerce%20Architect%20Course.htm
EC-Council, Online, http://www.eccouncil.org/Course-Outline/ECSA-LPTCourse.htm
EC-Council, Online, http://www.eccouncil.org/CourseOutline/Ethical%20Hacking%20and%20Countermeasures%20Course.htm
CyberPro
ph. (757) 871-3578
P a g e | 36
CyberPro
October 22, 2009
Foundstone Ultimate Hacking
&catid=191&country=United+States
&catid=191&country=United+States
EC-Council, Online, http://www.eccouncil.org/CourseOutline/Linux%20Security%20Course.htm
http://www.globalknowledge.com/training/wwwsearch.asp?country=United+St
ates&keyword=9806
EC-Council, Online, http://www.eccouncil.org/Course-Outline/ENSA.htm
Foundstone Ultimate Hacking
Expert
Foundstone Ultimate Web
Hacking
INFOSEC Certification and
Accreditation Basics
INFOSEC Forensics
INFOSEC Strategic Planning
Linux Security
Mandiant Incident Response
Network Management
Network Security
Administrator (ENSA)
Network Vulnerability
Assessment Tools
NIST 800-37 - Security
Certification and Accreditation
of Federal Information
Systems
NIST 800-37 - Security
Certification and Accreditation
of Federal Information
Systems - Executive Overview
Policy and Procedure
Development
Project Management in IT
Security
Red Hat Enterprise Security:
Network Services
EC-Council, Online, http://www.eccouncil.org/CourseOutline/Project%20Management%20in%20IT%20Security%20Course%20Outline
/Project%20Management%20in%20IT%20Security%20Course%20Outline.html
CyberPro
ph. (757) 871-3578
P a g e | 37
CyberPro
October 22, 2009
Risk Analysis and Management
Security Certified Network
Architect
Professional
Specialist
Security for Non-security
Professionals
SSCP Prep Course
Vulnerability Management
Security Certified Program, Self-Study,
http://www.securitycertified.net/getdoc/ac8d836b-cb21-4a87-8a344837e69900c6/SCNA.aspx
http://www.securitycertified.net/getdoc/6e1aea03-2b53-487e-bab686e3321cb5bc/SNCP.aspx
http://www.securitycertified.net/getdoc/f6d07ac4-abc2-4306-a54119f050f32683/SCNS.aspx
CYBER BUSINESS DEVELOPMENT OPPORTUNITIES
Office
DLA Acquisition
Locations
Procurement
Directorate
Procurement
Directorate
Title
Information Technology (IT) Information
Assurance Support and Management
Services, Defense Distribution Center (DDC)
DoD DMZ Engineering Support
DISA Implementation of Web Audit Log
Collection and Analysis Tools
Procurement
Directorate
Procurement
Directorate
PEO STRICOM
Domain Name System (DNS) Security
Support
Combined Federated Battle Lab Network
(CFBLNet) Support
D--Threat Computer Network Operation
(CNO) Teams for Test and Evaluation events
Department of
the Air Force
Department of
the Air Force
A+, Network+, Security+ Training and
Certification
D -- AIR FORCE SYSTEMS NETWORK
CyberPro
Link
https://www.fbo.gov/spg/DLA/J3/DDC/SP330009-R-0046/listing.html
https://www.fbo.gov/spg/DISA/D4AD/DITCO/RF
ICBest/listing.html
https://www.fbo.gov/spg/DISA/D4AD/DITCO/DI
SAWEBAUDIT/listing.html
https://www.fbo.gov/spg/DISA/D4AD/DITCO/D
omainNameSystemDNS/listing.html
https://www.fbo.gov/spg/DISA/D4AD/DTN/RFICFBLNet/listing.html
https://www.fbo.gov/index?s=opportunity&mo
de=form&id=d713ee539a271238c8580dd60427
31ea&tab=core&_cview=0
https://www.fbo.gov/spg/USAF/ACC/99CONS/F
3G3FA9167AC02/listing.html
https://www.fbo.gov/spg/USAF/AFMC/ESC/R22
49/listing.html
ph. (757) 871-3578
P a g e | 38
CyberPro
October 22, 2009
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Force
Materiel
Command
Air Combat
Command
Integrated Cyber Defense & Support
Technologies
Cyber Command and Control (C2)
Technologies
USAF Electronic Warfare Battle
Management Technology CRFI
CompTIA Security+ Training
https://www.fbo.gov/index?s=opportunity&mo
de=form&id=cd045a392c920683ccb0b03df09bb
134&tab=core&_cview=1
https://www.fbo.gov/spg/USAF/AFMC/AFRLRRS
/BAA0809-RIKA/listing.html
https://www.fbo.gov/spg/USAF/AFMC/ASC/US
AF_Electronic_Warfare_Battle_Management_T
echnology/listing.html
https://www.fbo.gov/spg/USAF/AFMC/88CONS
/FA8601-09-T-0049/listing.html
Military Communications and Surveillance
Technologies and Techniques
/BAA-09-09-RIKA/listing.html
CyberSoft VFind Security Tool Kit
Maintenance & Support
/FA8751-09-Q-0379/listing.html
Provide Information Awareness (IA) training
https://www.fbo.gov/spg/USAF/AFMC/75/F2DC
CR9180A001/listing.html
D – NETCENTS-2 Netops and Infrastructure
Solutions
https://www.fbo.gov/spg/USAF/AFMC/ESC/FA8
771-09-R-0018/listing.html
D – NETCENTS-2 NETOPS and Infrastructure
Solutions (Small Business Companion)
https://www.fbo.gov/spg/USAF/AFMC/ESC/FA8
Security Certificate & Accreditation Services
for Information Systems
https://www.fbo.gov/spg/USAF/AFMC/75/FA82
A -- National Intelligence Community
Enterprise Cyber Assurance Program
(NICECAP)
A+, Network+, Security+ Training and
Certification
/Reference-Number-BAA-06-11IFKA/listing.html
https://www.fbo.gov/spg/USAF/ACC/99CONS/F
3G3FA9167AC02/listing.html
Air Mobility
Command
IA Certification & Accreditation Process
https://www.fbo.gov/spg/USAF/AMC/HQAMCC
/EVSC1000/listing.html
United States
Marine Corps
R--Internet Monitoring Services
https://www.fbo.gov/spg/DON/USMC/M67004
/M6700409T0108/listing.html
Bureau of
Industry &
Security
International Competitive Bidding (ICB):
Implementation and Support of NATO
Enterprise
https://www.fbo.gov/spg/DOC/BIS/comp99/IFB
-CO-12870-NEDS/listing.html
CyberPro
ph. (757) 871-3578
P a g e | 39
CyberPro
October 22, 2009
Department of
the Army
Business
Transformation
Agency
National
Aeronautics and
Space
Administration
Washington
Headquarters
Services
D--Information Assurance, Engineering
System Solutions Development, Testing,
Deployment and Life Cycle Support
Sources sought or request for information
(RFI), DoD Information Assurance (IA)
Controls (For Information Purposes Only)
U--CISSP CERTIFICATION EDUCATION
https://www.fbo.gov/spg/USA/DABL/DABL01/
W91QUZ-09-0000/listing.html
BAA - Research and Studies for the Office of
Net Assessment (OSD/NA)
https://www.fbo.gov/spg/ODA/WHS/WHSAPO/
HQ0034-ONA-09-BAA-0002(1)/listing.html
CyberPro
https://www.fbo.gov/spg/ODA/BTA/BTABMD/HQ0566-09InformationAssurance/listing.html
https://www.fbo.gov/spg/NASA/GRC/OPDC202
20/NNC09306220Q/listing.html
ph. (757) 871-3578
P a g e | 40
CyberPro
October 22, 2009
EMPLOYMENT OPPORTUNITIES WITH NSCI
Job Title
Operational Deterrence Analyst
Defensive Cyber Ops Analyst
Cyber SME
Geospatial Analyst
Logistics All-Source Intelligence Analyst
SIGINT Analyst
Cyber Operations SME
Website Maintainer
Cyberspace Specialists
Cyberspace Manning IPT
Location
NE, VA
NE, VA, CO
NE, VA, TX, CO
NE
NE
NE, CO
NE
NE
NE
NE
CYBERPRO CONTENT/DISTRIBUTION
Officers
Chief Operations
Officer
Jim Ed Crouch
The articles and information appearing herein are intended for educational purposes to
promote discussion in the public interest and to keep subscribers who are involved in the
development of Cyber-related concepts and initiatives informed on items of common
interest. The newsletter and the information contained therein are not intended to
provide a competitive advantage for any commercial firm. Any misuse or unauthorized
use of the newsletter and its contents will result in removal from the distribution list
and/or possible administrative, civil, and/or criminal action.
----------------------------CyberPro
Editor-in-Chief
Lindsay Trimble
The views, opinions, and/or findings and recommendations contained in this summary are
those of the authors and should not be construed as an official position, policy, or
decision of the United States Government, U.S. Department of Defense, or National
Security Cyberspace Institute.
President
Larry K. McKee, Jr.
CyberPro
Research Analyst
Kathryn Stephens
CyberPro Archive
To subscribe or unsubscribe to this newsletter click here CyberPro News Subscription.
Please contact Lindsay Trimble regarding CyberPro subscription, sponsorship, and/or advertisement.
All rights reserved. CyberPro may not be published, broadcast,
rewritten or redistributed without prior NSCI consent.
CyberPro
ph. (757) 871-3578
P a g e | 41

CyberPro

Transcription

Similar documents

ENCORE: Studio: When State Actors and Cybercriminals Join Hands

KennethGeers

Register Now!

Web Safety

VOITTAVA KYBERSTRATEGIA Jarno Limnéll

It is a wonderful initiative to spread the message of

Slide #1 Doug - SANS Institute

Supertel

West Midlands Regional Cyber Crime Unit

Cyber Bullying - The HUGS Foundation